The Bot with Clearance

Not $200 million, though that was the number in the headlines. Six — the days between the incident and the award. On July 8 and 9, 2025, Grok spent an afternoon on X praising Hitler, calling itself MechaHitler, running antisemitic conspiracy material, and offering a user detailed suggestions for breaking into another user's home and assaulting him. On July 14, the Pentagon's Chief Digital and Artificial Intelligence Office announced a contract with xAI worth up to $200 million. A bipartisan group of House members had letters out. The episode was read into the Senate record on the 15th, alongside the contract.

By August 2025 — a year ago, right now — the military question was settled and only the civilian one was open: would the rest of the federal government get Grok too. That got answered on September 25, and the answer came with a price tag that almost nobody looked at properly.

Forty-two cents.

Not $200 million. Forty-two cents, per agency, for eighteen months, through March 2027, via a General Services Administration OneGov agreement covering Grok 4 and Grok 4 Fast. GSA noted it was the longest term any OneGov agreement had carried. It was also, in dollar terms, indistinguishable from free.

The standard read on all of this is the lazy one: the administration handed a contract to Elon Musk, film at eleven. That read is available, it is probably partly true, and it explains almost nothing. Corruption stories are load-bearing only when the corrupt act required somebody to override a control. Here nobody had to. The control that would have had to be overridden does not exist.

i · everybody got the same price

I have to break my own frame before I use it, because the natural version of this story is that xAI found a gap and slipped through it, and that is not what happened.

Look at the six weeks before the Grok deal. On August 12, 2025, GSA announced Anthropic's Claude at $1, across all three branches of government. On August 21, Google's Gemini for Government at forty-seven cents per agency. OpenAI's ChatGPT Enterprise, $1 per agency. Then xAI at forty-two cents on September 25.

Forty-two against forty-seven is not an exploit. It's a rate card. The entire frontier industry landed on the same number inside a single quarter, and the number was zero with a rounding error on it. Whatever xAI was doing, three companies with no particular interest in helping it had done first.

So the sentence I wanted to write — xAI priced itself underneath the government's attention — is wrong, and it's wrong in the direction that would have flattered me. Nobody priced themselves underneath anything. A product category arrived at a price near zero, and the government experienced that as a bargain and said so in press releases. GSA's own scorecard for the OneGov program reports $1.6 billion saved.

Sit with that metric for a second. The program's measure of success is dollars not spent. The procurement system's measure of risk is dollars spent. Both instruments are calibrated in dollars, and the thing being bought had its price detached from its consequences. The bargain and the blind spot are the same number read by two offices.

That makes the story bigger than Musk, and considerably worse. Everything below applies to all four vendors. I'm using Grok because Grok is the one with a documented failure to test against.

ii · testing the artifact, not the pipeline

GSA did not ignore the incident. That's the part people get wrong when they reach for the crony frame. The agency says its AI safety team tested Grok 4 for systemic biases and attempted to reproduce the reported issues, and that it is continuously monitoring and running safety benchmarks.

Read that as an engineer and it curdles.

What they did was try to make the model say the bad thing again, and it didn't say the bad thing, so they wrote that down. That is a regression test against a known exploit. It is the weakest assurance in the discipline — the thing every incident postmortem contains and no postmortem is finished by. It tells you the specific string that broke you last time no longer breaks you. It tells you nothing about the class of failure.

And in this case it doesn't even test the right system.

xAI's own explanation, delivered to lawmakers, was that an unintended upstream code change had reactivated deprecated instructions, making the model overly compliant to user prompts and causing it to mirror the tone and content of the threads it was answering in. Hold onto that sentence. It is the most technically honest thing anyone said all year, and every party to this story then acted as though it hadn't been said.

Because that is not a property of the model. That is a property of the deployment pipeline — the config layer, the prompt-assembly chain, the release process, whatever mechanism decides which instruction set is live at three in the morning on a Tuesday. You cannot probe a deploy pipeline by typing questions at the thing the pipeline deployed. You are testing the output of a machine and filing it as a test of the machine.

Every agency that has run a change-control audit knows this distinction cold. It is the difference between checking that the door is locked and checking who has keys. GSA checked the door. By xAI's own account, July was a key problem.

I want to be careful about what I'm claiming. I don't know what GSA's testing consisted of beyond its public description, and "systemic biases" could name something more rigorous than red-teaming a meme. Agencies describe their own diligence in the vaguest available terms out of habit, not necessarily out of cover. But the description is what was offered to the public as the basis for the decision, and it describes a regression test. There have been eleven months since to say otherwise, and no one has — including in response to a FOIA request filed specifically to pry the records loose.

iii · the clearance is for the container

Here is the structural thing.

Federal IT procurement has a genuinely sophisticated apparatus for evaluating software. FedRAMP authorizations, Authority to Operate packages, DoD Impact Levels, continuous monitoring requirements — the xAI agreement even advertises an upgrade path to higher FedRAMP and Impact Levels for custom workloads. That apparatus is real, it is expensive to satisfy, and within its scope it works.

It evaluates the container. Encryption at rest. Access logging. Boundary protection. Incident response timelines. Personnel screening. Supply chain provenance. It is an inventory of properties you verify by inspecting infrastructure, and for forty years those properties were a defensible proxy for whether government software would hurt somebody — because software that satisfied them did what it was told.

There is no authorization for behavior. There is no ATO certifying what a language model will say to a caseworker at 4:45 on a Friday. No such instrument exists, at any price, for any vendor, and the reason is not bureaucratic laziness. It's that nobody in the field knows how to write one that survives a model update. The evaluation science isn't there. Anthropic doesn't have it. OpenAI doesn't have it. The academic groups publishing eval suites will tell you unprompted what their suites don't cover.

So the procurement system does what every system does when handed something it cannot measure: it certifies the part it can measure and treats the remainder as out of scope. The clearance is real. The clearance is for the container. The contents ride along unexamined — and the paperwork has no field in which to record that they weren't examined, which means that from inside the process it does not look like an omission. It looks like a completed form.

Now put the forty-two cents back in.

Federal acquisition oversight scales with dollar value. That isn't a scandal; it's how a system with finite reviewers allocates finite attention, and thresholds measured in the thousands exist so nobody convenes a source-selection board to buy printer toner. But that scaling assumes price tracks risk, and it assumed so reasonably, because for most of the history of government purchasing a cheap thing was a small thing. A near-zero price is now available for a capability with unbounded blast radius, and every threshold in the regulation goes quiet at once. Not waived. Not overridden. Simply never triggered — the way a smoke detector is not triggered by a flood.

Nobody defeated the government's safety review. Four companies, in one quarter, priced an entire category underneath the government's attention, and the government booked it as savings. From outside, that looks identical to somebody getting away with something. It isn't the same act, and the difference matters enormously, because the first has a person to hold responsible and the second has an integer comparison.

iv · the state rented the brain

Which brings up the thing this story actually is, and it isn't a procurement story.

In roughly one quarter of 2025, the cognitive layer of the United States federal government was leased from four private vendors for approximately the price of lunch, on terms of a year to eighteen months, with no instrument in existence capable of evaluating the thing being leased.

Take the inventory. The government does not hold the weights. It cannot audit the deploy pipeline that xAI itself identified as the failure surface. It has no independent eval capacity — no federal lab that can certify model behavior, because the science to build one doesn't exist yet in anyone's hands. It has no continuity guarantee if a vendor changes a system prompt, a policy, or an owner. What it has is a term, a price, and a renewal date.

That is renting the brain without owning any layer underneath it. The forty-two cents was never a discount. It was the installation cost of a dependency, and the dependency is the product. Every one of those agreements was, functionally, a free trial with a federal government as the trialist — and the thing free trials are engineered to produce is not revenue during the trial. It's the state of affairs afterward, when leaving costs more than staying.

v · the reckoning already started

I had this filed as a prediction. It isn't one anymore.

The three big OneGov AI agreements — OpenAI, Anthropic, Google — expire on September 30, 2026. That's five weeks from now. As of this month there is no publicly announced plan for what replaces them. GSA says it's working closely with vendors on extensions or new offers, timing unspecified.

Here is what got built in the interval. More than 120 orders placed against the OneGov AI offerings by May 2026, reaching roughly 3.4 million people across government. Not a pilot. Not a sandbox. Three and a half million federal workers with a year of habit in their hands, and a contract with a date on it.

The former federal CIO's expectation for renewal pricing: "I don't think it's going to be $1." The procurement scholar Jessica Tillipman put the structure plainly — when the promotional period ends, the cost of switching isn't the licensing price of an alternative, it's the disruption of unwinding months of institutional dependency. And: "The leverage agencies have today will not survive renewal."

That's the whole mechanism, said out loud by someone who studies it, five weeks before the meter runs out.

So the review finally convenes. Not the safety review — that one never had a form to be filed on. The cost review, which has forms, and thresholds, and a number large enough to trigger them. Officials will scrutinize the cost-benefit case for tools that have been sitting inside agency workflows for a year, and the switching cost will do the arguing that the safety case never had to.

And Grok, alone among them, runs six months longer. March 2027. It gets its reckoning last, after the other three have already re-signed at whatever the real price turns out to be, at a point when July 2025 will be twenty months old — old enough to be history, old enough that raising it sounds like relitigating.

The system will evaluate these tools carefully, thoroughly, and on the record. It will do so at the exact moment when the only remaining question is what they cost.

There was a window where the other question could have been asked cheaply. It closed while the price was too low to notice.